Path Traversal in Apktool ResFileDecoder

This repository is a standalone C# proof-of-concept builder for CVE-2026-39973, a path traversal vulnerability in Apktool 3.0.1. It is not a framework module. The code constructs a malicious APK by generating a custom resources.arsc file and embedding an operator-provided payload file under a resource path whose type component contains repeated '..\\' traversal segments. When a vulnerable Apktool instance decodes the APK, the crafted resource type name can cause the payload to be written outside the intended output directory. Repository structure is small and focused: src/Program.cs is the main entry point and orchestrates user prompts, payload loading, malicious path construction, resources.arsc generation, and ZIP/APK creation. The Data classes (ResourceTable.cs, Package.cs, StringPool.cs, Type.cs) implement minimal Android resource table serialization sufficient to build a malicious resources.arsc. Enum/ChunkType.cs defines chunk constants, and Writer/ChunkWriter.cs handles chunk header writing and alignment. Main exploit capabilities: (1) accepts any local file as payload, (2) builds a malicious resources.arsc with a forged resource type name containing traversal, (3) packages both resources.arsc and the payload into an APK/ZIP archive, and (4) supports two target modes: Windows Startup folder and bashrc overwrite. In Windows mode, it substitutes a supplied username into 'Users\\<username>\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\' so the payload filename is written into the Startup folder, enabling persistence if the payload is an executable/script compatible with the environment. In Bashrc mode, it targets a bashrc path using '~\\' and names the key '.bashrc', intending shell startup file overwrite. The exploit is operational rather than a mere detector because it produces a malicious artifact and carries an arbitrary file payload, though payload customization is manual rather than framework-driven. No network communication, C2, or remote endpoints are present. The exploit is entirely local/file-based and intended to generate a malicious APK for later delivery to a vulnerable Apktool user or workflow.